{"id":"UBUNTU-CVE-2018-18655","details":"Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lacks a no-referrer setting.","modified":"2026-04-22T11:50:39.027339Z","published":"2018-10-26T00:29:00Z","upstream":["CVE-2018-18655"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2018-18655"},{"type":"REPORT","url":"https://bugs.debian.org/911842"},{"type":"REPORT","url":"https://telescoper.wordpress.com/2018/10/18/a-breakthrough-for-a-bigot/#comment-339386"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2018-18655"}],"affected":[{"package":{"name":"prayer","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/prayer@1.3.5-dfsg1-3?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5-dfsg1-3"],"ecosystem_specific":{"binaries":[{"binary_name":"prayer","binary_version":"1.3.5-dfsg1-3"},{"binary_name":"prayer-accountd","binary_version":"1.3.5-dfsg1-3"},{"binary_name":"prayer-templates-src","binary_version":"1.3.5-dfsg1-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-18655.json"}},{"package":{"name":"prayer","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/prayer@1.3.5-dfsg1-4build1?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5-dfsg1-4","1.3.5-dfsg1-4build1"],"ecosystem_specific":{"binaries":[{"binary_name":"prayer","binary_version":"1.3.5-dfsg1-4build1"},{"binary_name":"prayer-accountd","binary_version":"1.3.5-dfsg1-4build1"},{"binary_name":"prayer-templates-src","binary_version":"1.3.5-dfsg1-4build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-18655.json"}},{"package":{"name":"prayer","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/prayer@1.3.5-dfsg1-6.1?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5-dfsg1-6build1","1.3.5-dfsg1-6ubuntu1","1.3.5-dfsg1-6.1"],"ecosystem_specific":{"binaries":[{"binary_name":"prayer","binary_version":"1.3.5-dfsg1-6.1"},{"binary_name":"prayer-accountd","binary_version":"1.3.5-dfsg1-6.1"},{"binary_version":"1.3.5-dfsg1-6.1","binary_name":"prayer-templates-src"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-18655.json"}},{"package":{"name":"prayer","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/prayer@1.3.5-dfsg1-8build2?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5-dfsg1-8build1","1.3.5-dfsg1-8build2"],"ecosystem_specific":{"binaries":[{"binary_version":"1.3.5-dfsg1-8build2","binary_name":"prayer"},{"binary_name":"prayer-accountd","binary_version":"1.3.5-dfsg1-8build2"},{"binary_name":"prayer-templates-src","binary_version":"1.3.5-dfsg1-8build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-18655.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]}